EU and Swiss Data Protection compliance (GDPR & Swiss Data Privacy Act)

WE SUPPORT YOUR COMPLIANCE ON DATA PROTECTION LAWS

EU (GDPR) and Swiss Data Protection Compliance

In 25 May 2018, the EU General Data Protection Regulation (GDPR) become enforceable worldwide to any organizations based in Europe, processing data of data subjects located in the European Union or monitoring their behavior.

As of 1 September 2023, the revised version of the Swiss Federal Data Protection Act, very much aligned to the GDPR but with a few differences, became enforceable to all organizations processing personal data with effect in Switzerland.

Not sure where to start ? What documentation to use ? What immediate measures and actions to take to ensure you are compliant?

Our lawyers have experience advising and supporting foreign, EU and Swiss organizations on data protection compliance and privacy program implementation. Our data privacy specialists will guide you step-by-step so that you can achieve the best level of compliance based on your needs, risks on the processing and legal requirements.

We offer you to access template materials, DPO and Swiss representative external services, training for your staff and organization from employees to the senior executive level. datalex also develops its own tools and legal documentation, templates and checklists. We review, draft and negotiate service agreements and vendor contracts for your specific needs.

Ensure compliance and upskills your organization to embed a privacy vision and culture into your daily operations and improve your brand with more trust to your clients, business partners and consumers.

Our implementation strategy

Evaluate the conformity of your activities and their level of maturity.
Map your data and create an inventory of processing (data mapping).
Define an action plan and map the processed data.
Approve a plan and find a consensus.
Implement the GDPR principles based on your plan.
Monitor and manage vendor contracts with your business partners and subcontractors.
Prepare for data and security breach and incident response.

GDPR TOOLS

Practical examples

Does the GDPR or the Swiss DPA apply to your organization?

If your company is based in Switzerland, you are subject to the Swiss Data Protection Act. Also, the GDPR may also apply if your company is established in Europe. If your company is not established in Switzerland nor in Europe, but offers goods and services either to individuals or monitors their behaviour individuals in the EU or in Switzerland, you will have to comply with the applicable EU (GDPR) or Swiss (Swiss DPA) data protection.

What are the risks if my business is not compliant?

Risks vary depending on many factors, such as the nature and frequency of your processing activities, the size of your business and the number of customers and contractual partners, your level of security and data protection maturity, the structure of your business, and the manner in which you process and protect data subjects’ information.

Ultimately, a Data Protection Authority may issue a fine against your company which may amount up to EUR 10M to 20M, or 2% to 4% of your global annual turnover. In Switzerland, prosecution authorities may issue individual criminal penalties in case of willful misconduct for non-compliance with data protection provisions of the Swiss DPA.

We assist you in assessing the risks associated with your processing activities and in structuring and setting up an action plan for compliance.

Do I need to hire a Data Protection Officer (DPO)?

If your company is subject to the GDPR or the Swiss DPA, there are a number of situations in which it is necessary to appoint a Data Protection Officer (DPO). You will have to declare this person to the authorities, and this person will act as a link between your business and data protection authorities (DPA) and with individuals. This role also requires to perform other essential tasks, such as:

advising your company
developing a data protection culture
mapping your data
manage DPIAs and
responding to and collaborating with authorities in the event of incidents.

We offer to our clients the opportunity to use our services as external data protection officer for start-ups, SMEs and small multinationals.

In Switzerland, except if you are a a federal body, in which case having a DPO in mandatory, there is no obligation to appoint a data protection officer. However, an external data protection officer may help you increase your level of compliance and remove certain obligations or administrative tasks to comply with the law.

When do I need to appoint a Swiss data privacy Representative?

According to article 14 of the Swiss Data Protection Act (Swiss DPA), organizations with their registered office outside Switzerland must designate a representative in Switzerland.

You are obliged to hire a representative if your company processes personal data of data subjects located in Switzerland if you collect and use personal data in case:

you offer goods or services or if you run activities of monitoring of behaviour (e.g. online tracking via cookies, pixels, web beacons, etc.) in Switzerland; and if
it is extensive and regular and involves an increased risk to the personality of the persons concerned.

The Swiss DPA provides that the representative serves as a point of contact for the data subjects and the Federal Data Protection and Information Commissioner (FDPIC/PFPDT).

If you are a foreign organization with no presence in Switzerland (no offices, no affiliates nor subsidiaries) but you run services and have clients in Switzerland, you can appoint datalex to offer Swiss data protection representative services so that you can meet Swiss data protection requirements.

My activity is not subject to the GDPR, so does it mean I have nothing to do?

If the GDPR does not apply to you, other national data protection laws may apply, including in Switzerland. The Swiss Federal Data Protection Act has entered into force since 1 September 2023, which is very close to the EU Regulation 2016/679 (GDPR).

If you follow the GDPR principles as an industry standard, the criteria, obligations, constraints and rights for individuals will likely result in a high level of compliance with the Swiss Federal Data Protection Act (Swiss DPA). We help you pursue the ordinary course of your activities without worrying about legislative changes and costs increase to comply in a rush-mode to a new legislation.

Gabriel Avigdor

Our expert

Co-fondateur, associé
Certifié CIPP/E (RGPD)